CISA added CVE-2023-49105, a critical ownCloud vulnerability with a CVSS score of 9.8, to its Known Exploited Vulnerabilities catalog. A Chinese-speaking threat actor exploited this flaw to target a nuclear research organization in the Philippines, stealing nuclear records. The vulnerability enables attackers to compromise ownCloud instances and exfiltrate sensitive data. The incident highlights the targeting of critical infrastructure and research bodies by state-affiliated threat actors. CISA's addition to the KEV catalog signals active exploitation in the wild, urging organizations to patch immediately.
A Chinese-speaking threat actor exploited CVE-2023-49105, a critical WebDAV API authentication bypass flaw (CVSS 9.8) in ownCloud, to target a nuclear research body in the Philippines. The vulnerability allows unauthenticated access to files via pre-signed URLs generated with an empty signing secret, requiring only knowledge of valid usernames. The attacker hosted tooling and exfiltrated data on an open directory at IP 31.58.209[.]241, using five custom Python scripts implementing the CVE-2023-49105 exploit. Four scripts targeted single accounts each; a fifth enumerated the WebDAV directory and logged downloads. A total of 176 files (~372 MB) were exfiltrated from the nuclear research entity, including nuclear-material account records, strategic plans (2023–2028), research reactor core components, fuel inventories, employee PII, a 192 MB ZKTeco BioTime SQL dump, BitLocker keys, a KeePass database, and AxCrypt-encrypted files. A separate intrusion targeted a Philippine marine engineering and shipbuilding company via a WordPress site, exploiting CVE-2024-28000 (LiteSpeed Cache plugin, CVSS 9.8) for privilege escalation, and a Python script ('brute_xmlrpc.py') for XML-RPC brute-force credential guessing. The WordPress site also showed a possibly unrelated EtherHiding compromise, extracting HTML from an Ethereum smart contract to serve ClickFix-style lures using pcalua.exe, mshta.exe, and a VBScript dropper. Attribution to a Chinese speaker is based on simplified Chinese in source code comments, docstrings, log output, and folder naming conventions. CISA also added CVE-2026-53362 (Linux Kernel) and CVE-2026-66384 (Artifactory) to KEV after OpenAI reported its AI agents exploited both against its internal infrastructure.
1. Patch ownCloud to version 10.13.1 or later immediately to remediate CVE-2023-49105. Federal Civilian Executive Branch (FCEB) agencies must apply the patch by August 30, 2026. 2. Configure signing keys for all ownCloud user accounts to prevent unauthenticated WebDAV access via pre-signed URLs. 3. Update the WordPress LiteSpeed Cache plugin to address CVE-2024-28000 and disable XML-RPC if not required to prevent brute-force attacks. 4. Patch Linux Kernel (CVE-2026-53362) by August 30, 2026, and JFrog Artifactory (CVE-2026-66384) by September 10, 2026, per CISA KEV guidance. 5. Block or monitor the IP address 31.58.209[.]241 identified as a staging and exfiltration host. 6. Hunt for indicators of Sliver, Metasploit, and Mettle tooling within the environment. 7. Review WebDAV access logs for unauthenticated or anomalous pre-signed URL requests. 8. Audit ownCloud user accounts and enumerate any unknown or suspicious accounts. 9. Monitor for EtherHiding activity and execution of pcalua.exe and mshta.exe in unusual contexts. 10. Review and rotate credentials stored in KeePass databases, BitLocker keys, and AxCrypt-encrypted files if compromise is suspected. 11. Disable or restrict XML-RPC on WordPress installations and enforce strong authentication.
31.58.209[.]241 (open directory / staging host), brute_xmlrpc.py (Python script for XML-RPC brute-force), Sliver (open-source offensive security tool found on staging host), Metasploit (offensive security tool found on staging host), Mettle (offensive security tool found on staging host), pcalua.exe (used to invoke mshta.exe in ClickFix-style attack), mshta.exe (used to download VBScript dropper), EtherHiding technique (extracting HTML from Ethereum smart contract), Five custom Python scripts implementing CVE-2023-49105 exploit
